CVE-2026-9323

creationtimestamp| type| source ---|---|--- 2026-07-18 14:34:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqwicdxykb2z 2026-07-18 15:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mqwjrntoau2w 2026-07-18 16:39:55+00:00| seen|...

CVE-2026-54335

creationtimestamp| type| source ---|---|--- 2026-07-17 23:55:52+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqux7yi36n2j 2026-07-18 00:00:07+00:00| seen| https://bsky.app/profile/amadeustech.bsky.social/post/3mquxhjsacv2x...

CVE-2026-56171

creationtimestamp| type| source ---|---|--- 2026-07-17 14:00:06+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqtvwo4v522y 2026-07-17 14:00:11+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mqtvwt7bfv2z 2026-07-17 19:29:06+00:00| seen|...

CVE-2026-16072 Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface...

CVE-2026-14956

creationtimestamp| type| source ---|---|--- 2026-07-17 02:40:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqspwyuihy2i 2026-07-17 02:46:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqsqbg6u4i25...

EUVD-2026-45098

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

CVE-2026-62210 OpenClaw < 2026.6.1 Denial of Service via Remote Media URLs

OpenClaw versions before 2026.6.1 contain a denial of service vulnerability where remote media URLs can trigger slow-read attacks that exhaust gateway worker resources. Attackers with access to configured input paths can supply remote media URLs that consume gateway resources and reduce...

CVE-2026-57077

creationtimestamp| type| source ---|---|--- 2026-07-16 23:52:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqsgleymol2c 2026-07-17 01:24:01+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mqsloopgpk2p...

CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers th...

CVE-2026-44023 Docling Core has unsafe remote filename resolution

Docling Core defines core data types and transformations for the document processing application Docling. In versions 1.5.0 and above, prior to 2.74.1, docling-core did not sufficiently restrict remote request destinations and could resolve a server-provided Content-Disposition to a local path in...

CVE-2026-46512

creationtimestamp| type| source ---|---|--- 2026-07-16 18:52:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrvrushsg2x 2026-07-16 19:47:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqryvgoskh2u...

CVE-2026-63306

The CVE-2026-63306 issue affects stoatchat prior to 0.13.5 and is an unauthenticated server-side request forgery (SSRF) in the /proxy and /embed endpoints. The vulnerability allows supplying arbitrary URLs without DNS resolution filtering or private IP range validation, enabling attackers to enum...

CVE-2026-63306 stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints

stoatchat before 0.13.5 contains an unauthenticated server-side request forgery vulnerability in the /proxy and /embed endpoints that accept arbitrary URLs without DNS resolution filtering or private IP range validation. Attackers can enumerate internal services, fingerprint applications, and rea...

CVE-2026-15099

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrapdirectiontext function, which interpolates the...

CVE-2026-12525

creationtimestamp| type| source ---|---|--- 2026-07-16 08:24:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqsqf6ncd2e 2026-07-16 09:00:29+00:00| seen| https://infosec.exchange/users/offseq/statuses/116928835008172741 2026-07-16 09:00:31+00:00| seen|...

CVE-2026-15925

creationtimestamp| type| source ---|---|--- 2026-07-16 06:45:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqqn5t5xvw2i 2026-07-16 07:26:04+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqqph67fpj2c 2026-07-17 16:15:54+00:00| seen|...

CVE-2024-32389

Buffer Overflow vulnerability in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.320200803132042 allows a remote attacker to obtain sensitive information via the update URLs component...

CVE-2026-54443

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a...

EUVD-2026-44760

Dashy is a self-hostable personal dashboard. From 1.9.4 until 3.2.0, the Dashy RSS Widget in src/components/Widgets/RssFeed.vue does not sanitize RSS item link values before rendering feed item titles and Read More links as anchor href attributes, allowing an attacker-controlled feed to provide a...